Tcpdump is great and I was looking ahead using it. The bigger was my surprise when I could not, because tcpdump does not recognize my PPP internet connection (or better the ppp0 device) as being configured. Apple's Network Utility has the same sort of problem (it shows only en0, even while being on-line via PPP). Here's an example:

Of course, if anybody wonders about the way the ifconfig output looks like - it was mangled in the HTML conversion.
The stuffi between < and > is invisible. It was not clear wether the interface is UP and RUNNING. So, here is, once again, the code:

A quick look at the man page shows that in previous incarnations of this utility you had to be root to use it. I simply ran a sudo command, and presto, I have all the headers I can eat.
Command is as follows (a simple "-i" flag in the command lets you pick the interface):

I think it's something to do with the way the ppp0 interface is implemented in the Darwin kernel. If you try to run nmap on the ppp0 interface it gives a bit more info (which I don't have at hand). I also noticed that Apple's supplied network port scanner only let's you use the en0 interface.

I would say that tcpdump simply will not work with ppp0 until someone changes the implementation to support it. Try the darwin kernel mailing list or something.